// For flags

CVE-2024-27007

userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE

Severity Score

7.0
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to src_folio
when UFFDIO_MOVE fails") moved the src_folio->{mapping, index} changing to
after clearing the page-table and ensuring that it's not pinned. This
avoids failure of swapout+migration and possibly memory corruption. However, the commit missed fixing it in the huge-page case.

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: userfaultfd: cambie src_folio después de asegurarse de que no esté fijado en UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: corrija el cambio inesperado en src_folio cuando UFFDIO_MOVE falla") movió src_folio->{mapping, index} cambiando a después de borrar la tabla de páginas y asegurarse de que no esté fijada. Esto evita fallos en el intercambio+migración y posiblemente daños en la memoria. Sin embargo, la confirmación no solucionó el problema en el caso de la página enorme.

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails") moved the src_folio->{mapping, index} changing to after clearing the page-table and ensuring that it's not pinned. This avoids failure of swapout+migration and possibly memory corruption. However, the commit missed fixing it in the huge-page case.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-19 CVE Reserved
  • 2024-05-01 CVE Published
  • 2024-05-13 EPSS Updated
  • 2024-12-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.8 < 6.8.8
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.8 < 6.8.8"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.8 < 6.9
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.8 < 6.9"
en
Affected